Postconditions: what we check

• query · trpc-query-missing-try-catch

  error
  Whenasync function calls a tRPC vanilla client .query() method without wrapping in try-catch. Throws TRPCClientError on network failures, HTTP errors, or server procedure errors (UNAUTHORIZED, NOT_FOUND, INTERNAL_SERVER_ERROR, TIMEOUT, TOO_MANY_REQUESTS).
  ThrowsTRPCClientError — extends Error with shape, data (contains code, httpStatus), cause (original Error), and meta (response object). Wraps server-thrown TRPCError codes: UNAUTHORIZED (401), FORBIDDEN (403), NOT_FOUND (404), INTERNAL_SERVER_ERROR (500), TIMEOUT (408), TOO_MANY_REQUESTS (429), BAD_REQUEST (400).
  Required handlingCaller MUST wrap .query() in try-catch and handle TRPCClientError. Use isTRPCClientError(cause) to narrow the type. Minimum handling: try { const result = await trpc.someRoute.query(input); } catch (cause) { if (isTRPCClientError(cause)) { console.error('tRPC error:', cause.data?.code, cause.message); } throw cause; }
  costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[1][2]
• mutate · trpc-mutate-missing-try-catch

  error
  Whenasync function calls a tRPC vanilla client .mutate() method without wrapping in try-catch. Throws TRPCClientError on network failures, HTTP errors, or server procedure errors (UNAUTHORIZED, NOT_FOUND, INTERNAL_SERVER_ERROR, CONFLICT, UNPROCESSABLE_CONTENT, etc.).
  ThrowsTRPCClientError — extends Error with shape, data (contains code, httpStatus), cause (original Error), and meta (response object). Mutation errors include UNAUTHORIZED (401), CONFLICT (409), UNPROCESSABLE_CONTENT (422), INTERNAL_SERVER_ERROR (500), BAD_REQUEST (400 — failed input validation).
  Required handlingCaller MUST wrap .mutate() in try-catch and handle TRPCClientError. Minimum handling: try { const result = await trpc.someRoute.mutate(input); } catch (cause) { if (isTRPCClientError(cause)) { if (cause.data?.code === 'UNAUTHORIZED') { // redirect to login } console.error('Mutation failed:', cause.message); } throw cause; }
  costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[1][2]
• subscribe · trpc-subscribe-missing-on-error

  error
  Whenasync function calls a tRPC vanilla client .subscribe() method without providing an onError callback in the options object. All subscription errors (network disconnect, server TRPCError, UNAUTHORIZED, WebSocket close via TRPCWebSocketClosedError) are silently dropped — the internal error path is opts.onError?.(err), which is a no-op when the callback is absent.
  ThrowsTRPCClientError — dispatched via onError callback, NOT thrown into calling code. Error is silently dropped when onError is absent. Error codes covered: UNAUTHORIZED (401), FORBIDDEN (403), INTERNAL_SERVER_ERROR (500), TIMEOUT (408), SERVICE_UNAVAILABLE (503), BAD_REQUEST (400), and TRPCWebSocketClosedError when the underlying WebSocket connection closes during an active subscription.
  Required handlingCaller MUST provide onError in the subscribe() options object. Minimum handling: const sub = trpc.liveUpdates.subscribe(input, { onData(data) { // handle incoming data }, onError(cause) { if (isTRPCClientError(cause)) { if (cause.data?.code === 'UNAUTHORIZED') { // redirect to login or refresh auth } console.error('Subscription error:', cause.message); } }, onComplete() { // subscription ended normally }, });
  costmediumin prodsilent failureusers seelost datavisibilitysilent
  Sources[3][4][2]
• subscribe · trpc-subscribe-auth-error-silent

  error
  WhentRPC subscription receives UNAUTHORIZED (401) or FORBIDDEN (403) from the server (token expired, session revoked, or permission change during an active real-time connection) but caller has no onError callback to detect the auth failure. The subscription is cancelled server-side and the client silently stops receiving data without any error signal.
  ThrowsTRPCClientError with data.code = 'UNAUTHORIZED' or 'FORBIDDEN'. Dispatched via optional onError callback — silently dropped if absent.
  Required handlingCheck cause.data?.code in onError handler and redirect to login or refresh the auth token when 'UNAUTHORIZED' or 'FORBIDDEN' is received.
  costmediumin prodsilent failureusers seeauthentication failurevisibilitysilent
  Sources[4][2]

Sources

Every postcondition cites at least one of these. Grouped by source type; numbered to match the footnotes above.

Research notes

Curator notes from SOURCES.md captured when the profile was written so you can verify the reasoning, not just the rules.